<para>
  <emphasis>
    In the tradition of
    <ulink
      url="http://tuxedo.org/~esr/writings/cathedral-bazaar/cathedral-bazaar/"
      >release early, release often
    </ulink>
    this document escaped version control at an immature stage.
    General direction and structure is not yet fixed.
    Big changes are likely.
    You might want to look at the discussion on 
    <ulink url="&list_linuxdoc;">LDP-discuss</ulink>.
    For the time being you will find complete source of this release
    and all previous versions <ulink url="../../">here</ulink>.
  </emphasis>
</para>

<para>
  Writing a program that inserts code into another program file is one
  thing. Writing that program so that it can be injected itself is a
  very different art. Although this document shows a lot of code
  and technique, it is far from being a
  <quote>Construction Kit For Dummies</quote>.
  Instead I'll try to show how things work. Translation of infecting
  code to assembly is left as a (non-trivial) exercise to the reader.
</para>
<para>
  An astonishing number of people think that viruses require
  secret black magic. Here you will find simple code that patches
  other executables. But since regular users can't overwrite system
  files (we are talking about serious operating systems here)
  that is not even half the journey. To make any impact you need root
  permissions. Either by tricking the super user to run your virus,
  or combining it with a root-exploit. And since all popular
  distributions come with checksum mechanisms, a single command
  can detect any modification. Unless you implement kernel-level
  stealth functionality&hellip;
</para>
<para>
  I do believe that free software is superior, at least in regard
  to security.  And I strongly oppose the argument that Linux viruses
  will flourish once it reaches a critical mass of popularity.
  On the contrary I question the credibility of people whose income
  relies on widespread use of ridiculously insecure operating systems.
</para>
<para>
  This document is my way to fight the
  <ulink url="&jargon_FUD;">FUD</ulink>.
  Use the information presented here in any way you like.
  I bet that Linux will only grow stronger.
</para>

<sect2 id="behind_the_stages">
  <title>Behind the stages</title>

  <para>
    All sections titled <quote>Output</quote> are real product
    of source code and shell scripts included in this document.
    Most numbers and calculations are processed by a Perl script
    parsing these output files. The document itself is written in 
    <ulink url="http://docbook.sourceforge.net/">DocBook</ulink>,
    a SGML document type definition. Conversion to HTML is the last
    step of a Makefile that builds and runs all examples.
  </para>
  <para>
    I used an installation of
    <ulink url="http://www.redhat.com/">RedHat</ulink> 7.2 for
    development All required tools are contained on the
    <ulink url="http://www.redhat.com/download/howto_download.html"
      >freely downloadable CDs</ulink>.
  </para>

</sect2>

<sect2 id="copyright">
  <title>Copyright Information</title>

  <para>
    This document is copyrighted (c) 2002 Alexander Bartolich and is
    distributed under the terms of the Linux Documentation Project
    (LDP) license, stated below.
  </para>

  <para>
    Unless otherwise stated, Linux HOWTO documents are
    copyrighted by their respective authors. Linux HOWTO documents may
    be reproduced and distributed in whole or in part, in any medium
    physical or electronic, as long as this copyright notice is
    retained on all copies. Commercial redistribution is allowed and
    encouraged; however, the author would like to be notified of any
    such distributions.
  </para>

  <para>
    All translations, derivative works, or aggregate works
    incorporating any Linux HOWTO documents must be covered under this
    copyright notice. That is, you may not produce a derivative work
    from a HOWTO and impose additional restrictions on its
    distribution. Exceptions to these rules may be granted under
    certain conditions; please contact the Linux HOWTO coordinator at
    the address given below.
  </para>

  <para>
    In short, we wish to promote dissemination of this
    information through as many channels as possible. However, we do
    wish to retain copyright on the HOWTO documents, and would like to
    be notified of any plans to redistribute the HOWTOs.
  </para>

  <para>
    If you have any questions, please contact
    <email>linux-howto@metalab.unc.edu</email>
  </para>
</sect2>

<sect2 id="disclaimer">
  <title>Disclaimer</title>

  <para>
    No liability for the contents of this documents can be accepted.
    Use the concepts, examples and other content at your own risk.
    As this is a new edition of this document, there may be errors
    and inaccuracies, that may of course be damaging to your system.
    Proceed with caution, the author does not take any responsibility.
  </para>
  <para>
    <emphasis>
      Who am I kidding? This is dangerous stuff!
      Stop reading immediately or risk lethal pollution of your systems!
    </emphasis>
  </para>
  <para>
    All copyrights are held by their respective owners, unless
    specifically noted otherwise.  Use of a term in this document
    should not be regarded as affecting the validity of any trademark
    or service mark.
  </para>
  <para>
    Naming of particular products or brands should not be seen
    as endorsements.
  </para>
  <para>
    You are strongly recommended to take a backup of your system
    before major installation and backups at regular intervals.
  </para>
</sect2>

<sect2 id="newversions">
  <title>New Versions</title>

  <formalpara>
    <title>2002-03-09</title>
    <para>Unfinished excerpt sent to Linux Documentation Project.</para>
  </formalpara>
  <formalpara>
    <title>2002-03-11</title>
    <para>
      Unfinished excerpt sent to Linux Documentation Project.
      <itemizedlist>
        <listitem>
	  <para>
	    Section <xref linkend="one_step_closer"> rewritten &amp;
	    finished.
	  </para>
        </listitem>
      </itemizedlist>
    </para>
  </formalpara>
  <formalpara>
    <title>2002-03-14</title>
    <para>
      Genie escaped the bottle.
      <itemizedlist>
        <listitem>
	  <para>
	    Added epigraphs to all sections, removed one offending
	    paragraph on the way.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Added example for large scale scanning in
	    <xref linkend="the_plan">.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Started section <xref linkend="entry_point">.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Started <xref linkend="credits">.
	  </para>
        </listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <formalpara>
    <title>2002-03-15</title>
    <para>
      I predict that today will be remembered until tomorrow.
      <itemizedlist>
        <listitem>
	  <para>
	    First working example in <xref linkend="entry_point">.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Lots of small fixes about everywhere.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Renamed from <quote>The Linux Virus Writing HOWTO</quote>.
	  </para>
        </listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <formalpara>
    <title>2002-03-17</title>
    <para>
      What we do not understand we do not possess.
      <itemizedlist>
        <listitem>
	  <para>
	    Added section <xref linkend="before_we_start">.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Finished section <xref linkend="entry_point">.
	    Fixed a silly bug in the output of the heuristic scanner.
	  </para>
        </listitem>
        <listitem>
	  <para>
	    Started <xref linkend="additional_cs">.
	  </para>
        </listitem>
      </itemizedlist>
    </para>
  </formalpara>

  <formalpara>
    <title>2002-03-19</title>
    <para>
      The mosquito exists to keep the mighty humble.
      <itemizedlist>
        <listitem>
	  <para>
	    Tuned <xref linkend="freedom_is_security">.
	  </para>
        </listitem>
      </itemizedlist>
      <itemizedlist>
        <listitem>
	  <para>
	    Changed <xref linkend="the_plan"> and
	    <xref linkend="patchShdr"> to make infected executables
	    safe for <command>strip</command>.
	    Bug resulted from sloppy reading of the holy text.
	  </para>
        </listitem>
      </itemizedlist>
      <itemizedlist>
        <listitem>
	  <para>
	    Started section <xref linkend="rst">.
	  </para>
        </listitem>
      </itemizedlist>
    </para>
  </formalpara>

</sect2>
<sect2 id="credits" xreflabel="Credits">
  <title>Credits</title>

  <para>
    Everything in this document is either plain obvious or has been
    written by someone else long time ago. My meager contribution is
    nice formatting, reproducibility and the idea to take the subject
    to mainstream media. But I'm certainly not innovative.
  </para>

  <formalpara>
    <title>Silvio Cesare</title>
    <para>
      <email>silvio@big.net.au</email>
      Founder of the trade. Keeper of the source.
      Check out <ulink url="&silvio_cesare;">&silvio_cesare;</ulink>
      and admire the release date.
    </para>
  </formalpara>

  <formalpara>
    <title>John Reiser</title>
    <para>
      <email>jreiser@BitWagon.com</email>
      Found one bug and two superfluous bytes in <xref linkend="evil-magic">.
      Proved that I can't code a straight &calc_evil_magic_codesize_D;
      byte <quote>Hello World</quote>.
    </para>
  </formalpara>

  <formalpara>
    <title>paddingx</title>
    <para>
      Contributed technical details and implementation for
      <xref linkend="additional_cs">.
    </para>
  </formalpara>

  <para>
    A lot of people helped me shape language and ethical position of
    this document (sorted by Perl, blame Larry): &calc_credits;.
  </para>

</sect2>
<sect2 id="feedback">
  <title>Feedback</title>

  <para>
    Feedback is most certainly welcome for this document.
    Please send your additions, comments and criticisms to the following
    email address: <email>alexander.bartolich@gmx.at</email>
  </para>
</sect2>
